python3-autobahn: Upgrade 26.10.2 -> 26.11.1

Upgrade to release 26.11.1:

- Security: parse the HTTP headers of the WebSocket opening
  handshake strictly (RFC 9112, RFC 9110). The header block was
  split with str.splitlines(), which also splits on VT, FF, FS, GS,
  RS, NEL and on a bare CR or LF, so a peer could make autobahn see
  header lines that a front proxy treats as part of a header value,
  for example an X-Forwarded-For used with trustXForwardedFor.
  Lines are now separated by CRLF only. ⚠ behaviour change — a
  header block with a bare CR or LF, obs-fold, whitespace before
  the colon, an invalid header name, a header line without a colon
  (was skipped), or a control character in a header value or the
  status line is rejected: the server fails the handshake with HTTP
  400, the client fails the handshake or the proxy CONNECT. A bare
  LF is rejected deliberately, although RFC 9112 allows accepting
  it as a line end. obs-text (0x80-0xFF) in header values is still
  allowed, and header values are trimmed of SP and HTAB only. This
  fixes advisory GHSA-2gqc-mwv3-66rp

- Security: raise the floors of the compress extra (and so all)
  to brotli>=1.2.1 (CPython) and brotlicffi>=1.2.1.0 (PyPy), the
  releases with the fix for CVE-2026-111497, an out-of-bounds write
  in the brotli decoder that permits remote code execution.
  permessage-brotli decodes data sent by the WebSocket peer; it is
  not used unless an application offers or accepts it. The brotli
  1.0.10 and 1.1.1 backports of the fix are not enough, since the
  permessage-brotli receive path needs the decompression limit of
  brotli 1.2. New tests check the declared floors and the installed
  version

- Add tests for the HTTP header parsing of the WebSocket opening
  handshake, on the server, the client and the explicit proxy
  CONNECT, run on Twisted and asyncio

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>

meta-python/recipes-devtools/python/python3-autobahn_26.11.1.bb

@@ -0,0 +1,28 @@
+DESCRIPTION = "WebSocket client & server library, WAMP real-time framework"
+HOMEPAGE = "http://crossbar.io/autobahn"
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=49165a577911c4178e915dc26e2802a3"
+
+SRC_URI += "file://0001-Skip-march-guessing-for-external-cross-toolchains.patch"
+
+SRC_URI[sha256sum] = "1a081ca27ad5a0a04d3c7ca07b2caa6d324b8004383e36ae6eede1d5053e23b0"
+
+CVE_PRODUCT = "autobahn"
+
+inherit pypi python_hatchling
+
+DEPENDS += " \
+    python3-cffi-native \
+"
+
+RDEPENDS:${PN} += " \
+    python3-twisted \
+    python3-zopeinterface \
+    python3-py-ubjson \
+    python3-cbor2 \
+    python3-u-msgpack-python \
+    python3-lz4 \
+    python3-snappy \
+    python3-pyopenssl \
+    python3-txaio \
+"